element-hq / element-hq/element-web

Account verification is a no-op if no backup passphrase is set up

Open
#14,013 0 comments 0 reactions 0 assignees View on GitHub
A-E2EE A-E2EE-Cross-Signing T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Description

I've got a cross-signed account (hosting synapse & riot-web myself) and it's working with a good number of peers.

A friend signed up a matrix.org address at riot.im, but didn't yet set up a backup passphrase. We verified each other's accounts (note: not a device). However, despite the verification flow looking as normal (request, accept, emojis, "all great" message) afterwards nothing changed. No green shield, no verification in the sidebar. Also no trace of the verification in our private chat. Side note: Also no devices were verified instead.

Then we discovered the friend hasn't set up the passphrase. He did that and we repeated the process. This time it succeeded and we have green shields on both sides.

### Expected

I would expect that account verification works even if there is no key backup. After all, our chat was encrypted by default already, so a loss of keys would lead to a loss of chat messages anyway.

I would also expect that if for some reason verification is not possible, it should not offter the "verify" button for that user. Or at least fail early in the UI flow. Showing an "all great" message when in fact nothing happened is certainly the worst outcome of all.

### Version information

My side:

- Browser: Firefox 77.0.1
- OS: Ubuntu 20.04 all updated
- URL: self-hosted riot-web 1.6.4

The friend's side:

- Browser: don't know
- OS: I think Windows 10
- URL: https://riot.im

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.